The data controller decides the needs for which as well as means by which own details is processed. PCI DSS compliance is the whole process of adhering to the set of controls and expectations for securing physical and on the web money transactions. The PCI SSC has outlined twelve specifications https://www.nathanlabsadvisory.com/blog/nathan/vapt-solutions-in-uae-enhancing-cybersecurity-and-resilience-for-businesses/